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A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) OR THIRTY (30) DAYS, 
WHICHEVER IS LONGER. FROM THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1.136(a). In no event however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

• if NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 1 33). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1 .704(b). 

Status 

1 )E Responsive to communication(s) filed on March 01. 2006 . 
2a)S This action is FINAL. 2b)n This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 1 1 , 453 O.G. 213. 

Disposition of Claims 

4) ^ Claim(s) 1-1 S and 20-28 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) K Claim(s) 18.20 and 21 is/are allowed. 

6) [3 Claim(s) 1-12. 14-17 and 22-28 is/are rejected. 

7) ^ Claim(s) 13 is/are objected to. 

8) n Claim(s) are subject to restriction and/or election requirement. 

Applicdtion Papers 

9) 0 The specification is objected to by the Examiner. 

10)0 The drawing(s) filed on is/are: a)n accepted or b)n objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1 .85(a). 

Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1 .121 (d). 
1 !)□ The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 

Priority under 35 U.S.C. § 119 

12)0 Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 119(a)-(d) or (f). 
a)n All b)n Some * 0)0 None of: 

1 .□ Certified copies of the priority documents have been received. . 

2. n Certified copies of the priority documents have been received in Application No. . 

3. p Copies of the certified copies of the priority documents have been received in this National Stage 

application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 
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DETAILED ACTION 

Claim Rejections - 35 USC § 102 

1 . The following is a quotation of the appropriate paragraphs of 35 U.S.C. 1 02 that form the 
basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in a patent granted on an application for patent by another filed in the United 
States before the invention thereof by the applicant for patent, or on an international application by another 
who has fulfilled the requirenfients of paragraphs (1), (2), and (4) of section 371 (c) of this title before the 
invention thereof by the applicant for patent. 

2. Claims 1-5 are rejected under 35 U.S.C. 102(e) as being anticipated by Mahler et al. 
(U.S. 6,910,134, "Mahler''). 

Regarding claim 1, Mahler discloses, "a system for classifying packets based on 
packet content, the system comprising: 

- a sequencer {processor 104 fig,2) operable to receive packets {from 102 fig.2) and 
to identify packet flows (co/.5, /n. 13-14 where . . .identify tliat particular traffic flow)\ 

- a content engine {content processor 110 fig.2) interfaced with the sequencer to 
receive packets {from 104 fig.2) and to search packet contents {col. 7, In. 12 where 

. . .scanned against a database of known signatures) for predetemiined expressions {col. 
7, line 13 where ...known signatures) in a packet or in a packet flow; and 

- a tag map interfaced with the content engine and operable to perform mappings 
between expressions and subexpressions (co/.8, ln.27-38 where ...compares the 
significant bits (subexpressions) ...known strings (expressions) that resides in signature 
memory) to generate modified tags for {116 fig.2; col.6, ln.3-18 where it is required to tag 
packets to assign to one of its quality of sen/ice queues; As an example, the method of 
tagging packets for virus infected data is described in col. 10, ln.43-63) according to the 
predetermined expressions found by the content engine." 
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Regarding claim 2, Mahler further discloses, "the sequencer comprises: 

- an enqueue engine {memory 106 fig.2) operable to read packet flow sequencing 
information (co/.5, In. 13-14 where a memory is required to save tlie information to 
identify traffic flow)\ 

- a packet flow tracker {flow management processor 122 fig.2) interfaced with the 
enqueue engine and operable to track packet flows {col.7, ln.2-3) with the sequencing 
information; and 

- a dequeue engine {memory 106 fig.2) interfaced with the packet flow tracker and the 
content engine, the dequeue engine forwarding packets to the content engine {from 104 
to 110 fig.2) according to stream identification information received from the packet flow 
tracker (co/.5, In. 13-14 where ...a unique session id created by header preprocessor)." 

Regarding claim 3, Mahler further discloses, "the enqueue engine is further 
operable to determine that a packet is out of order for that packets flow (co/.4, In. 54-56) 
and to transmit the out-of-order packet to have any missing packets resent {transmit 
missing or odd packets to processor 124 fig.2 for further processing as described in 
col.7, lnA-5): 

Regarding claim 4. Mahler further discloses, "the dequeue engine fonfl/ards the 
next packet of the flow (coA 7, In. 58-65 where the content processor receives the next 
packet from the dequeue engine because it can process one packet or traffic flow with 
session id) for the stream identification information received from the packet flow 
tracker." 
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Regarding claim 5, Mahler further discloses, "the dequeue engine determines 
that no packets for the packet flow are ready and determines a second packet flow to 
send to the content engine {coL 7, In. 58-65 where the content processor receives the 
next packet from the dequeue engine because it can process one packet or traffic flow 
with session id) " 

Claim Rejections - 35 USC § 103 

3. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art 
are such that the subject matter as a whole would have been obvious at the time the invention was made to 
a person having ordinary skill in the art to which said subject matter pertains. Patentability shall not be 
negatived by the manner in which the Invention was made. 

4. Claims 6, 8-17 and 22-28 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Mahler in view of Fritchman (U.S. 6,785,677, Tritchman"): 

Regarding claim 6, Mahler lacks what Fritchman discloses, "the content engine 
comprises: a non-deterministic finite automata engine {col, 1, ^.54-57) operable to 
search packet content for one or more regular expressions; and one or more hash 
engines {col. 2, In. 54-65) operable to search packet content for one or more 
subexpressions." 

Therefore, it would have been obvious to one of ordinary skill in the art at the 
time of invention was made to include the non-deterministic finite automata (NFA) 
engine and the hash engine to the content engine taught by Mahler. The motivation of 
including the NFA is to read a string of symbols from its regular language such like 
alphabet. The motivation of including the hash engine is designed to efficiently store 
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non-contiguous key (account number, part number, etc.) that may wide gaps in tlieir 
alphabet and numeric sequences. 

Regarding claims 8, 16 and 24, Mahler further discloses, "the non-deterministic 
finite automata engine comprises field programmable gate arrays (FPGA) {col. 11, ln.38- 
39 where the fast pattern processor uses FPGA, which is a programmable processor)" 

Regarding claim 9, Mahler further discloses, "a state store module interfaced with 
the non-deterministic finite engine and operable to save the state of the non- 
deterministic finite automata engine associated with a packet flow so that the saved 
state is available for the search of the next packet of the packet flow." The detailed 
procedure for dealing with the state information such as storing, updating and searching 
for the next packets associating with the particular traffic flow is described in column 
8:65-column 9:15. 

Regarding claim 10, Mahler further discloses, "the content engine further 
comprising a tag map interfaced with the content engine to map the packet to a tag 
based on the content search {116 in figure 2; coL 6, lines 3-18 where it is required to tag 
packets to assign to one of its quality of service queues; As an example, the method of 
tagging packets for virus infected data is described in col. 10, lines 43-63)" 

Regarding claim 1 1 , it is a claim corresponding to claims 1 and 6 and is therisfore 
rejected for the similar reasons set forth in the rejection of claims 1 and 6. 
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Regarding claim 12, Mahler further discloses, "the packet flow comprises a TCP 
stream {IP network 10 fig. 1 where TCP protocol is used In the IP network).'' 

Regarding claim 13, it is a claim corresponding to claims 2-5 and is therefore 
rejected for the similar reasons set forth in the rejection of claims 2-5. 

Regarding claim 14, it is claim con^esponding to claim 6 and is therefore rejected 
for the similar reasons set forth in the rejection of claim 6. 

Regarding claim 15, Mahler lacks what Fritchman discloses, "computing a hash 
for a subexpression of a regular expression match; and finding a subexpression match if 
the computed hash matches a hash in a hash look-up table (co/.2, ln.54-65).'' 

Therefore, it would have been obvious to one of ordinary skill in the art at the 
time of applicant's invention to include the function of computing a hash taught by 
Fritchman into the content engine of Mahler in order to have a fast string searching tool 
for classifying packets. 

Regarding claim 17^ it is a claim about the procedure of dealing with state 
information corresponding to claim 9 and is therefore rejected for the similar reasons set 
forth in the rejection of claim 9. 

Regarding claim 22, it is a claim corresponding to claims 1, 6 and 7 and is 
therefore rejected for the similar reasons set forth in the rejection of claims 1 . 6 and 7. 
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Regarding claim 23, Mahler further discloses the hash look-up table comprising 
bit engine that indexes the hash according to the position of bits in col.8, lines 27-38. 

Regarding claims 25-28, they are claims about the procedure of dealing with 
state information. The detailed procedure for dealing with the state information such as 
storing, updating and searching for the next packets associating with the particular traffic 
flow is described in column 8:65-column 9:15. 



5. Claim 7 is rejected under 35 U.S.C. 103(a) as being unpatentable over Mahler in view of 
Fritchman and further in view of Imai et al. (U.S. 6,367.076, "Imai"). 

Regarding claim 7, Mahler and Fritchman are silent on the content engine further 
comprising a lexical analyzer interfaced with the non-deterministic finite automata engine 
and the hash engine, the lexical analyzer detemiining characters of the packets. 
However, Imai teaches the lexical analyzer determining characters of the packets 
{lexical analyzer 31 fig. 1; coL 6, In. 53-54). 

Therefore, it would have been obvious to one of ordinary skill in the art at the 
time of invention was made to include a lexical analyzer taught by Imai into the content 
engine disclosed by Mahler-Fritchman for the process of taking an input string of 
character and producing a sequence of symbols called lexical tokens in the content 
processor. The motivation of including the lexical analyzer is to read through the input 
one character at a time, changing states based on what character it encounters. 

Allowable Subject Matter 

6. Claims 18, 20, and 21 are allowed. 
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7. Claim 13 is objected to as being dependent upon a rejected base claim, but would be 
allowable if rewritten in independent fonn including all of the limitations of the base claim 
and any intervening claims. 

Response to Arguments 

8. The applicant's arguments filed on March 01, 2006 have been fully considered, but they 
are not persuasive. 

Rejection under 35 U.S.C. S102 

At page 8, for the amended claim 1, applicant argues Mahler does not disclose 
"the use of a tag map to perform mappings between expressions and subexpressions to 
generate modified tags." In reply. Mahler teaches that a signature memory determines 
whether there is a potential match between the significant bits (subexpressions) of the 
context and the known strings (expression) as described in col.8, lines 27-38. The 
conclusion reached by signature memory needs to be tagged. For example, the method 
of tagging packets for virus infected data is described in col. 10, ln.43-63. Therefore, the 
examiner respectfully disagrees. 

At pages 8-9, applicant's arguments with respect to the amended independent 
claim 18 have been fully considered and are persuasive. The rejection of claim 18 has 
been withdrawn. 



Rejection under 35 U,S.C. 5103 

At page 1 1 , for the amended claim 1 1 , applicant argues that Mahler and 
Fritchman do not disclose "a tag map used to perform a mapping between regular 
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expressions and subexpressions and is further used to generate a modified tag 
corresponding to matcli between predetermined expressions and subexpressions." In 
reply, this is a claim corresponding to claims 1 and 6 and is rejected for the similar 
reasons set forth described in the reply above for claim 1. Therefore, the examiner 
respectfully disagrees. 

At page 11, for the amended claim 22, applicant argues that Mahler and 
Fritchman do not disclose "a tag map used to perform a mapping between regulpr 
expressions and subexpressions and is further used to generate a modified tag 
corresponding to match between predetermined expressions and subexpressions." In 
reply, this is a claim con^esponding to claims 1 , 6, and 7 and is rejected for the similar 
reasons set forth described in the reply above for claim 1 . Therefore, the examiner 
respectfully disagrees. ' 

Conclusion 

9. THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as 
set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the 
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advisory action. In no event, however, will the statutory period for reply expire later than 
SIX MONTHS from the mailing date of this final action. 



10. Any inquiry concerning this communication or earlier communications from the examiner 
should be directed to Jung Park whose telephone number is 571-272-8565. The 
examiner can normally be reached on Mon-Fri during 7:10-4:40. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Chau Nguyen can be reached on 571-272-3126. The fax phone number for 
the organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for published 
applications may be obtained from either Private PAIR or Public PAIR. Status 
information for unpublished applications is available through Private PAIR only. For 
more information about the PAIR system, see http://pair-direct.uspto.gov. Should you 
have questions on access to the Private PAIR system, contact the Electronic Business 
Center (EBC) at 866-21 7-91 97 (toll-free). 
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